423b250 · a43303d · eb8ff12 · f17673d
@@ -15,3 +15,5 @@
A new read of a table that grows (`event`, `issue`, `run`, `comment`) names the
A new `/settings…` page route goes in `src/http/settings_routes.ts` (`settingsRoutes`), not `src/http/server.ts`.
State shared between modules through process memory, not the database, is named here. `src/perf/views_report.ts`: `readVisits` holds each scope and window's visits for 15 seconds (dropped by `flushViews`), so a page and its probe share one read; `src/perf/views_store.ts`: the view buffer, flushed every 10 seconds. The traffic sources view's terminal door is `src/tui/screens/trafficview.ts` (palette entry for admins, per-app command for a repository's admins). `src/runs/held.ts`: each dispatcher pass (`src/crew/dispatch.ts`, `pump`) records which queued agent runs it held and why (valve, pace, limit), and vitals (`src/kernel/vitals.ts`) leaves those out of `queue:agent`. A record older than `HELD_FRESH_MS` is ignored, so a stopped dispatcher cannot hide its queue.
`src/core/transfer.ts`: the old owner/name pairs a transfer left behind (`repo_redirect`), held per database after the first request reads them and dropped by `transferRepo`, so a request under a path nothing moved from costs no statement (#569).
@@ -0,0 +1,31 @@
# Moving a repository to another owner
From the terminal: on a repository's screen, `:` then "Move this repository
to another owner", and type the new owner. From the API:
`POST /api/v1/repos/:owner/:name/transfer` with `{"newOwner": "<account or org>"}`
moves a repository (an `rw` token; the caller administers the repository and
may create repositories under the new owner — themselves, or an org they can
write to). It is refused when the new owner already has a repository by that
name.
What moves: the repository row's owner and the bare repository on disk, in
one step — the directory is renamed back if the database write fails.
Everything keyed by the repository (its app, secrets, crew, autonomy,
direction, issues and pulls) travels with it; a fork's link to its objects is
rewritten. Nothing else on disk is named by owner/name: an app's data lives
under its app id, crew checkouts and install caches under the repository's
id, and mirrors under its id, so none of them move. Moves run one at a time,
so two moves to the same owner/name cannot both pass the checks.
Who moved what from where to where is kept twice: an audit row in
`repo_transfer`, written in the move's own transaction and never rewritten,
and a `repo.transferred` event for the repository's readers.
Old paths keep working: a web or API request under the old `owner/name`
answers `308` to the same path under the new owner, for reads and writes
alike (a write is never applied silently; the client re-sends it). Someone
who cannot read the repository still gets `404`. Making a new repository at
the old path takes the path back.
Not yet: git remotes under the old path, runs and previews follow in the next
step.
@@ -0,0 +1,63 @@
/**
 * Transfer a repository to another owner (#569). The caller administers the
 * repository and may create repositories under the new owner (themselves, or
 * an org they can write to — the same rule as making one there). An agent
 * never moves anything. The move is `core/transfer.ts`; the event
 * (`repo.transferred`, for the repository's readers) and the audit row
 * (`repo_transfer`, written in the move's own transaction) say who moved what
 * where.
 */
import type { App } from "../app.ts";
import { getUserByName, type User } from "../core/users.ts";
import { canAdmin, type Repo } from "../core/repos.ts";
import { transferRepo, type TransferError } from "../core/transfer.ts";
import { storageChanged } from "../core/storage.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { resolveOwner } from "./repos.ts";
export type TransferActionError = TransferError | "not_found" | "forbidden_owner" | "unknown_owner";
export const TRANSFER_SAID: Readonly<Record<Exclude<TransferActionError, "not_found">, string>> = {
  name_taken: "The new owner already has a repository by that name.",
  same_owner: "The repository already belongs to that owner.",
  move_failed: "The repository could not be moved; nothing changed.",
  forbidden_owner: "You cannot create repositories under that owner.",
  unknown_owner: "No account or organisation has that name.",
};
/** The HTTP status each refusal answers with. */
export const TRANSFER_STATUS: Readonly<Record<Exclude<TransferActionError, "not_found">, number>> = {
  name_taken: 409,
  same_owner: 409,
  move_failed: 500,
  forbidden_owner: 403,
  unknown_owner: 422,
};
export async function transferRepository(
  app: App,
  actor: User | undefined,
  repo: Repo,
  newOwner: string,
): Promise<Result<Repo, TransferActionError>> {
  if (actor === undefined || actor.kind === "agent" || !canAdmin(app.db, repo, actor)) return err("not_found");
  const target = getUserByName(app.db, newOwner);
  if (target === undefined || target.kind === "agent") return err("unknown_owner");
  const ownerId = resolveOwner(app, actor, target.username);
  if (ownerId !== target.id && !actor.isAdmin) return err("forbidden_owner");
  const moved = await transferRepo(app.db, app.reposRoot, repo, target, actor.id);
  if (!moved.ok) return moved;
  storageChanged(app, repo.ownerId);
  storageChanged(app, target.id);
  app.bus.append({
    kind: "repo.transferred",
    repoId: repo.id,
    actorId: actor.id,
    payload: {
      from: `${repo.ownerName}/${repo.name}`,
      to: `${moved.value.ownerName}/${moved.value.name}`,
    },
  });
  return ok(moved.value);
}
@@ -320,6 +320,7 @@
export { route as postApiV1ReposOwnerNameRunsIdCancel } from "./postApiV1ReposOw
export { route as postApiV1ReposOwnerNameRunsIdSteer } from "./postApiV1ReposOwnerNameRunsIdSteer.ts";
export { route as postApiV1ReposOwnerNameSpend } from "./postApiV1ReposOwnerNameSpend.ts";
export { route as postApiV1ReposOwnerNameSync } from "./postApiV1ReposOwnerNameSync.ts";
export { route as postApiV1ReposOwnerNameTransfer } from "./postApiV1ReposOwnerNameTransfer.ts";
export { route as postApiV1ReposOwnerNameUpstreamCheck } from "./postApiV1ReposOwnerNameUpstreamCheck.ts";
export { route as postApiV1Sessions } from "./postApiV1Sessions.ts";
export { route as postApiV1Share } from "./postApiV1Share.ts";
@@ -0,0 +1,18 @@
import { REPO, type Route } from "../shared.ts";
export const route: Route = {
  method: "post",
  path: `${REPO}/transfer`,
  summary: "Move a repository to another owner, an account or an organisation the caller may create repositories under (rw scope, a repository admin's); its old web and API paths answer 308 to the new ones; answers the repository",
  auth: true,
  body: { newOwner: "string" },
  refusals: {
    not_found: "404: no such repository, or the caller is not its admin",
    bad_new_owner: "422: newOwner is not a name",
    unknown_owner: "422: no account or organisation has that name",
    forbidden_owner: "403: the caller cannot create repositories under that owner",
    name_taken: "409: the new owner already has a repository by that name",
    same_owner: "409: the repository already belongs to that owner",
    move_failed: "500: the repository could not be moved; nothing changed",
  },
};
@@ -144,6 +144,8 @@
const READER_KINDS: ReadonlySet<string> = new Set([
  "repo.links_probed",
  "repo.detached",
  "repo.deleted",
  // Who moved a repository from where to where (#569): its readers knew both paths.
  "repo.transferred",
  "label.updated",
  "label.deleted",
  "telemetry.granted",
@@ -0,0 +1,1 @@
8b91e4340037d69d32cb5f9001336fb4ce44f759f275d052df5ff1c9a2437a53
@@ -0,0 +1,29 @@
// Where a moved repository went (#569): one row per old owner/name, naming
// the repository by id, so its old web and API paths answer 308 to wherever
// it lives now — even after a second move. Written by `transferRepo`
// (`core/transfer.ts`) in the same transaction as the repo row's new owner;
// a repository later made at the old path takes it back (the row is only
// read when no repository answers there). Cascades with the repository.
// `repo_transfer` is the audit trail: one row per move, never rewritten —
// who moved which repository from where to where, and when.
// Idempotent (#558): a second apply finds the table and changes nothing.
export default `
  CREATE TABLE IF NOT EXISTS repo_redirect (
    owner_name TEXT NOT NULL COLLATE NOCASE,
    name       TEXT NOT NULL COLLATE NOCASE,
    repo_id    TEXT NOT NULL REFERENCES repo(id) ON DELETE CASCADE,
    moved_by   TEXT NOT NULL DEFAULT '',
    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
    PRIMARY KEY (owner_name, name)
  );
  CREATE INDEX IF NOT EXISTS repo_redirect_repo ON repo_redirect(repo_id);
  CREATE TABLE IF NOT EXISTS repo_transfer (
    id         TEXT PRIMARY KEY,
    repo_id    TEXT NOT NULL,
    from_path  TEXT NOT NULL,
    to_path    TEXT NOT NULL,
    actor_id   TEXT NOT NULL,
    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
  );
  CREATE INDEX IF NOT EXISTS repo_transfer_repo ON repo_transfer(repo_id, id);
  `;
@@ -0,0 +1,168 @@
/**
 * Moving a repository to another owner (#569): the storage half. The bare
 * repository is renamed on disk, then one transaction gives the repo row its
 * new owner and records where the old path went (`repo_redirect`). When the
 * transaction fails the directory is renamed back, so disk and rows never
 * disagree. Everything else about a repository — its app, secrets, crew,
 * autonomy, direction, issues and pulls — is keyed by the repo's id, so it
 * travels with the row; an app's data lives under its app id and does not
 * move. A fork's `alternates` file names its parent's objects by absolute
 * path, so each fork's is rewritten to the new place.
 */
import type { Database } from "bun:sqlite";
import { mkdir, readFile, rename, rmdir, writeFile } from "node:fs/promises";
import { dirname, join } from "node:path";
import { closeReader } from "../git/read.ts";
import { repoDir, repoDirExists } from "../git/repos.ts";
import { id } from "../kernel/id.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { forgetListings } from "./listings.ts";
import { getRepo, getRepoById, listForks, type Repo } from "./repos.ts";
import type { User } from "./users.ts";
export type TransferError = "name_taken" | "same_owner" | "move_failed";
/**
 * The old owner/name pairs, held in process memory per database so the
 * common request — under a path nothing moved from — costs no statement.
 * Loaded on first use; `transferRepo` drops it. A pair whose row has gone
 * (its repository deleted) only costs the one lookup that finds nothing.
 */
const moved = new WeakMap<Database, Set<string>>();
const key = (ownerName: string, name: string): string => `${ownerName.toLowerCase()}/${name.toLowerCase()}`;
function movedPaths(db: Database): Set<string> {
  let paths = moved.get(db);
  if (paths === undefined) {
    paths = new Set(
      db
        .query<{ owner_name: string; name: string }, []>("SELECT owner_name, name FROM repo_redirect")
        .all()
        .map((r) => key(r.owner_name, r.name)),
    );
    moved.set(db, paths);
  }
  return paths;
}
/** Where an old owner/name went, when no repository answers there now. */
export function redirectFor(db: Database, ownerName: string, name: string): Repo | undefined {
  if (!movedPaths(db).has(key(ownerName, name))) return undefined;
  const row = db
    .query<{ repo_id: string }, [string, string]>(
      "SELECT repo_id FROM repo_redirect WHERE owner_name = ?1 AND name = ?2",
    )
    .get(ownerName, name);
  if (row === null) return undefined;
  if (getRepo(db, ownerName, name) !== undefined) return undefined;
  return getRepoById(db, row.repo_id);
}
async function rewriteAlternates(forkDir: string, from: string, to: string): Promise<void> {
  const file = join(forkDir, "objects", "info", "alternates");
  const text = await readFile(file, "utf8").catch(() => undefined);
  if (text === undefined || !text.includes(from)) return;
  await writeFile(file, text.split(from).join(to));
}
/**
 * One transfer at a time in this process: the checks (name free, place
 * free), the rename and the transaction run as one step, so two moves to
 * the same owner/name cannot both pass the checks, and a rollback never
 * renames back over a directory another move just put there. Moves are rare;
 * a single queue costs nothing worth a finer lock.
 */
let queue: Promise<unknown> = Promise.resolve();
export function transferRepo(
  db: Database,
  reposRoot: string,
  repo: Repo,
  target: User,
  movedBy: string,
): Promise<Result<Repo, TransferError>> {
  const turn = queue.then(() => moveNow(db, reposRoot, repo, target, movedBy));
  queue = turn.catch(() => undefined);
  return turn;
}
async function moveNow(
  db: Database,
  reposRoot: string,
  stale: Repo,
  target: User,
  movedBy: string,
): Promise<Result<Repo, TransferError>> {
  // The row as it is now, not as the caller read it before waiting its turn.
  const repo = getRepoById(db, stale.id);
  if (repo === undefined) return err("move_failed");
  if (target.id === repo.ownerId) return err("same_owner");
  if (getRepo(db, target.username, repo.name) !== undefined) return err("name_taken");
  const from = repoDir(reposRoot, repo.ownerName, repo.name);
  const to = repoDir(reposRoot, target.username, repo.name);
  if (await repoDirExists(to)) return err("name_taken");
  const hadDir = await repoDirExists(from);
  if (hadDir) {
    closeReader(from);
    await mkdir(dirname(to), { recursive: true });
    try {
      await rename(from, to);
    } catch {
      return err("move_failed");
    }
  }
  const fromPath = `${repo.ownerName}/${repo.name}`;
  const toPath = `${target.username}/${repo.name}`;
  try {
    db.transaction(() => {
      db.query("UPDATE repo SET owner_id = ?1 WHERE id = ?2").run(target.id, repo.id);
      // The new path is a real repository now; a redirect that pointed it
      // elsewhere would never be read, so it goes.
      db.query("DELETE FROM repo_redirect WHERE owner_name = ?1 AND name = ?2").run(target.username, repo.name);
      db.query(
        `INSERT INTO repo_redirect (owner_name, name, repo_id, moved_by) VALUES (?1, ?2, ?3, ?4)
           ON CONFLICT (owner_name, name) DO UPDATE SET repo_id = excluded.repo_id,
             moved_by = excluded.moved_by, created_at = excluded.created_at`,
      ).run(repo.ownerName, repo.name, repo.id, movedBy);
      db.query(
        "INSERT INTO repo_transfer (id, repo_id, from_path, to_path, actor_id) VALUES (?1, ?2, ?3, ?4, ?5)",
      ).run(id(), repo.id, fromPath, toPath, movedBy);
    })();
    moved.delete(db);
  } catch {
    if (hadDir) await rename(to, from).catch(() => undefined);
    return err("move_failed");
  }
  if (hadDir) {
    // The old owner's directory may be empty now; leave it if not.
    await rmdir(dirname(from)).catch(() => undefined);
    const objectsFrom = join(from, "objects");
    const objectsTo = join(to, "objects");
    for (const fork of listForks(db, repo.id)) {
      await rewriteAlternates(repoDir(reposRoot, fork.ownerName, fork.name), objectsFrom, objectsTo).catch(
        () => undefined,
      );
    }
  }
  forgetListings(db);
  const after = getRepoById(db, repo.id);
  return after === undefined ? err("move_failed") : ok(after);
}
export interface TransferRecord {
  readonly from: string;
  readonly to: string;
  readonly actorId: string;
  readonly at: string;
}
/** The audit trail of a repository's moves, oldest first. */
export function transfersOf(db: Database, repoId: string): TransferRecord[] {
  return db
    .query<{ from_path: string; to_path: string; actor_id: string; created_at: string }, [string]>(
      "SELECT from_path, to_path, actor_id, created_at FROM repo_transfer WHERE repo_id = ?1 ORDER BY id",
    )
    .all(repoId)
    .map((r) => ({ from: r.from_path, to: r.to_path, actorId: r.actor_id, at: r.created_at }));
}
@@ -117,6 +117,7 @@
import {
  resolveOwner,
  updateRepoSettings,
} from "../actions/repos.ts";
import { TRANSFER_SAID, TRANSFER_STATUS, transferRepository } from "../actions/transfer.ts";
import {
  createToken,
  HUMAN_CHECK_MESSAGE,
@@ -1672,6 +1673,24 @@
export function apiRoutes(router: Router<Handler>): void {
    return json({}, 200);
  });
  // Move a repository to another owner (#569): its old paths answer 308.
  router.add("POST", "/api/v1/repos/:owner/:name/transfer", async (ctx) => {
    const denied = requireScope(ctx, "rw");
    if (denied) return denied;
    const repo = loadRepo(ctx);
    if (!repo) return notFound();
    const input = await body(ctx.request);
    const newOwner = input.newOwner;
    if (typeof newOwner !== "string" || newOwner.length === 0 || newOwner.length > 64)
      return apiError("bad_new_owner", 422, "newOwner is an account or organisation name");
    const moved = await transferRepository(ctx.app, ctx.auth.user, repo, newOwner);
    if (!moved.ok) {
      if (moved.error === "not_found") return notFound();
      return apiError(moved.error, TRANSFER_STATUS[moved.error], TRANSFER_SAID[moved.error]);
    }
    return json(repoJson(ctx, moved.value));
  });
  router.add("GET", "/api/v1/repos/:owner/:name/events", (ctx) => {
    notePhase(ctx.request, "session", takeSessionTime(ctx.request));
    const repo = loadRepo(ctx);
@@ -0,0 +1,36 @@
/**
 * A moved repository's old paths (#569). A web or API request under an
 * owner/name that a transfer left behind answers 308 to the same path under
 * the repository's new owner — a GET and a mutation alike, so a write is never
 * applied silently to the new place: the client re-sends it, knowing where.
 * Only a caller who may read the repository learns where it went; anyone else
 * keeps the 404 a missing path has always answered.
 */
import type { Database } from "bun:sqlite";
import { canRead } from "../core/repos.ts";
import { redirectFor } from "../core/transfer.ts";
import type { User } from "../core/users.ts";
import { isSafeName } from "../git/guard.ts";
const API = "/api/v1/repos/";
/** The owner/name a path names, its prefix and the rest; undefined when it names none. */
function repoPath(pathname: string): { prefix: string; owner: string; name: string; rest: string } | undefined {
  const prefix = pathname.startsWith(API) ? API : "/";
  const parts = pathname.slice(prefix.length).split("/");
  if (parts.length < 2) return undefined;
  const [owner, name] = parts as [string, string];
  if (!isSafeName(owner) || !isSafeName(name)) return undefined;
  return { prefix, owner, name, rest: parts.slice(2).join("/") };
}
export function movedResponse(db: Database, url: URL, user: User | undefined): Response | undefined {
  const at = repoPath(url.pathname);
  if (at === undefined) return undefined;
  const repo = redirectFor(db, at.owner, at.name);
  if (repo === undefined || !canRead(db, repo, user)) return undefined;
  const rest = at.rest === "" && !url.pathname.endsWith("/") ? "" : `/${at.rest}`;
  const location = `${at.prefix}${encodeURIComponent(repo.ownerName)}/${encodeURIComponent(repo.name)}${rest}${url.search}`;
  return new Response(null, { status: 308, headers: { location } });
}
@@ -443,6 +443,7 @@
import { pageParamRefused } from "./cursor_lists.ts";
import { inNamespace } from "../core/proposal_token.ts";
import { proposalTokenMint, proposalTokenRevoke } from "../web/pages/proposal-tokens.ts";
import { adminGate } from "./admin_gate.ts";
import { movedResponse } from "./moved.ts";
import { originGate } from "./origin_gate.ts";
import { proposalGate } from "./proposal_gate.ts";
import { runGate } from "./run_gate.ts";
@@ -2816,6 +2817,10 @@
async function answerGet(
  const adminRefusal = adminGate(app, request, url, auth);
  if (adminRefusal !== undefined) return adminRefusal;
  // A transferred repository's old path answers 308 to its new one (#569).
  const moved = movedResponse(app.db, url, auth.user);
  if (moved !== undefined) return moved;
  // The two things standing between one runaway agent and everybody
  // else's latency, applied before a handler runs and after auth is
  // known — a limit needs an identity, and a replay needs a credential.
@@ -0,0 +1,57 @@
/**
 * Move this repository to another owner, from a repository screen's `:`
 * palette (#569): the terminal's door to `POST …/transfer`. The new owner's
 * name is typed; the move refuses what the API refuses, in the same words.
 * Only a person who administers the repository is offered it.
 */
import { TRANSFER_SAID, transferRepository } from "../../actions/transfer.ts";
import { canAdmin, type Repo } from "../../core/repos.ts";
import type { Ctx, Screen } from "../app/app.ts";
import type { Command } from "../app/palette.ts";
import type { Session } from "../session.ts";
import { promptScreen } from "./common.ts";
export const TRANSFER_REPO = "Move this repository to another owner";
/** The prompt floats over whatever is already drawn; this is the empty backdrop it asks for. */
const backdrop: Screen = {
  title: TRANSFER_REPO,
  keys: [],
  render() {},
  key: () => false,
};
export function transferRepoCommands(f: Session, ctx: Ctx, repo: Repo | undefined): Command[] {
  if (repo === undefined || f.user === undefined || f.user.kind !== "user") return [];
  if (!canAdmin(f.db, repo, f.user)) return [];
  const full = `${repo.ownerName}/${repo.name}`;
  return [
    {
      id: "transfer-repository",
      title: `${full} — ${TRANSFER_REPO}`,
      hint: "old links answer with the new place",
      run: () =>
        ctx.push(
          promptScreen(ctx, backdrop, {
            title: TRANSFER_REPO,
            label: `Moves ${full} with its issues, pulls, app and crew. New owner:`,
            placeholder: "an account or organisation",
            onSubmit: (typed) => {
              const newOwner = typed.trim();
              if (newOwner === "") return "Type the new owner's name.";
              return (async () => {
                const moved = await transferRepository(f.app, f.user, repo, newOwner);
                if (!moved.ok) {
                  ctx.toast(moved.error === "not_found" ? "no such repository" : TRANSFER_SAID[moved.error], "danger");
                  return;
                }
                ctx.toast(`moved ${full} to ${moved.value.ownerName}/${moved.value.name}`, "success");
                ctx.leaveRepo(repo.id);
              })();
            },
          }),
        ),
    },
  ];
}
@@ -131,6 +131,7 @@
import { workingCommands } from "./working.ts";
import { forgeItCommands } from "./forge_it.ts";
import { makeItYoursScreen, yoursCommands } from "./yours.ts";
import { deleteRepoCommands } from "./deleterepo.ts";
import { transferRepoCommands } from "./transferrepo.ts";
import { grantsCommands } from "./grants.ts";
import { visionCommands } from "./vision.ts";
import { buildsCommands } from "./builds.ts";
@@ -1448,6 +1449,7 @@
export function workspaceScreen(
      ...reportsCommands(f, ctx, repo),
      ...noteCommands(f, ctx, () => screen, repo),
      ...yoursCommands(f, ctx, repo),
      ...transferRepoCommands(f, ctx, repo),
      ...deleteRepoCommands(f, ctx, repo),
      ...grantsCommands(f, ctx, repo),
      ...forgeItCommands(f, ctx, repo, () => screen),
@@ -21,6 +21,7 @@
import {
import { createApp, type App } from "../src/app.ts";
import { listTeams, OWNERS_TEAM, type Team } from "../src/core/orgs.ts";
import { migrations } from "../src/core/schema.ts";
import { idFloor } from "../src/kernel/id.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser, getUserByName, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
@@ -217,11 +218,18 @@
describe("an organization always keeps a person who owns it", () => {
    ]);
    const ddl = migrations.find((m) => m.includes("an agent never owns"));
    expect(ddl).toBeString();
    const before = (
    const last = (
      app.db.query("SELECT id FROM event ORDER BY id DESC LIMIT 1").get() as {
        id: string;
      }
    ).id;
    // The migration stamps its id from SQLite's wall clock; `id()` is
    // monotonic per process, so a suite earlier in the same process that
    // moved `Date.now` ahead (`api-forge-view.test.ts`) leaves it ahead of
    // the wall. The bound is the last event or the wall clock, whichever is
    // older: with an honest clock that is the last event, as before.
    const wall = idFloor(Date.now());
    const before = last < wall ? last : wall;
    app.db.exec(ddl!);
    expect(members(owners)).not.toContain(bot.id);
    expect(members(owners)).toContain(alice.id);
@@ -0,0 +1,267 @@
/**
 * Moving a repository to another owner (#569): `POST …/transfer {newOwner}`
 * moves the row and the bare repository, and the old web and API paths answer
 * 308 to the new ones — GETs and mutations alike. The refusals come first.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { existsSync } from "node:fs";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { openIssue } from "../src/actions/issues.ts";
import { createOrg } from "../src/actions/orgs.ts";
import { openPull } from "../src/actions/pulls.ts";
import { commitToBranch, createRepo } from "../src/actions/repos.ts";
import { createApp as createAppRow, getAppByRepo } from "../src/core/apps.ts";
import { migrationFiles } from "../src/core/schema.ts";
import { createRepo as makeRepo, forkRepo, getRepo, getRepoById, type Repo } from "../src/core/repos.ts";
import { transferRepo, transfersOf } from "../src/core/transfer.ts";
import { getUserByName } from "../src/core/users.ts";
import { commitFiles } from "../src/git/write.ts";
import { readFileSync } from "node:fs";
import { createToken } from "../src/core/tokens.ts";
import { createUser, type User } from "../src/core/users.ts";
import { repoDir } from "../src/git/repos.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { quietLogs } from "./helpers/globals.ts";
quietLogs();
const PASSWORD = "a-long-transfer-passphrase";
describe("transferring a repository", () => {
  let dataDir = "";
  let app: App;
  let servers: Servers;
  let alice: User;
  let bob: User;
  let aliceRw = "";
  let aliceRo = "";
  let bobRw = "";
  let repo: Repo;
  let issueNumber = 0;
  let pullNumber = 0;
  const call = (path: string, token: string, method = "GET", payload?: unknown) =>
    fetch(`${servers.url}${path}`, {
      method,
      redirect: "manual",
      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
      ...(payload === undefined ? {} : { body: JSON.stringify(payload) }),
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-transfer-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    const made = async (username: string, admin: boolean) => {
      const u = await createUser(app.db, {
        origin: "seed",
        trusted: true,
        username,
        email: `${username}@forge.local`,
        password: PASSWORD,
        adminIfFirst: admin,
      });
      if (!u.ok) throw new Error(u.error);
      return u.value;
    };
    alice = await made("alice", true);
    bob = await made("bob", false);
    aliceRw = createToken(app.db, alice.id, "rw", "rw").token;
    aliceRo = createToken(app.db, alice.id, "ro", "ro").token;
    bobRw = createToken(app.db, bob.id, "rw", "rw").token;
    const org = createOrg(app, alice, "lab");
    if (!org.ok) throw new Error(org.error);
    const r = await createRepo(app, alice, { name: "notes", visibility: "public" });
    if (!r.ok) throw new Error(String(r.error));
    repo = r.value;
    await commitToBranch(app, alice, repo, { message: "seed", files: [{ path: "README.md", content: "# notes\n" }] });
    await commitToBranch(app, alice, repo, {
      branch: "topic",
      base: "main",
      message: "topic",
      files: [{ path: "T.md", content: "t\n" }],
    });
    const pull = await openPull(app, alice, repo, { title: "Topic", body: "", baseBranch: "main", headBranch: "topic" });
    if (!pull.ok) throw new Error(String(pull.error));
    pullNumber = pull.value.number;
    const issue = openIssue(app, alice, repo, { title: "Bookmarked" });
    if (!issue.ok) throw new Error(String(issue.error));
    issueNumber = issue.value.number;
    const appRow = createAppRow(app.db, { repoId: repo.id, slug: "notes", access: "public" });
    if (!appRow.ok) throw new Error(appRow.error);
    // A second "notes" under bob, so moving there is refused.
    const clash = await makeRepo(app.db, app.reposRoot, { ownerId: bob.id, name: "notes", visibility: "public" });
    if (!clash.ok) throw new Error(String(clash.error));
  }, 30_000);
  afterAll(async () => {
    await servers.stop();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("a read-only token, a stranger and a taken name are refused, and nothing moves", async () => {
    expect((await call("/api/v1/repos/alice/notes/transfer", aliceRo, "POST", { newOwner: "lab" })).status).toBe(403);
    expect((await call("/api/v1/repos/alice/notes/transfer", bobRw, "POST", { newOwner: "bob" })).status).toBe(404);
    const taken = await call("/api/v1/repos/alice/notes/transfer", aliceRw, "POST", { newOwner: "bob" });
    expect(taken.status).toBe(409);
    expect(((await taken.json()) as { error: string }).error).toBe("name_taken");
    expect((await call("/api/v1/repos/alice/notes/transfer", aliceRw, "POST", { newOwner: 7 })).status).toBe(422);
    expect((await call("/api/v1/repos/alice/notes/transfer", aliceRw, "POST", { newOwner: "nobody" })).status).toBe(
      422,
    );
    expect(getRepo(app.db, "alice", "notes")?.id).toBe(repo.id);
  });
  test("bob cannot move his own repository under an org he is not in", async () => {
    const res = await call("/api/v1/repos/bob/notes/transfer", bobRw, "POST", { newOwner: "lab" });
    expect(res.status).toBe(403);
  });
  test("the move takes the row, the bare repository and the app along", async () => {
    const res = await call("/api/v1/repos/alice/notes/transfer", aliceRw, "POST", { newOwner: "lab" });
    expect(res.status).toBe(200);
    expect(getRepo(app.db, "lab", "notes")?.id).toBe(repo.id);
    expect(getRepo(app.db, "alice", "notes")).toBeUndefined();
    expect(existsSync(join(repoDir(app.reposRoot, "lab", "notes"), "HEAD"))).toBe(true);
    expect(existsSync(repoDir(app.reposRoot, "alice", "notes"))).toBe(false);
    expect(getAppByRepo(app.db, repo.id)?.slug).toBe("notes");
    const event = app.db
      .query<{ actor_id: string; payload: string }, [string]>(
        "SELECT actor_id, payload FROM event WHERE kind = 'repo.transferred' AND repo_id = ?1",
      )
      .get(repo.id);
    expect(event?.actor_id).toBe(alice.id);
    expect(JSON.parse(event!.payload)).toMatchObject({ from: "alice/notes", to: "lab/notes" });
  });
  test("the old page, API path, issue and pull answer 308 to the new ones", async () => {
    const page = await call("/alice/notes", aliceRw);
    expect(page.status).toBe(308);
    expect(page.headers.get("location")).toBe("/lab/notes");
    const api = await call("/api/v1/repos/alice/notes?x=1", aliceRw);
    expect(api.status).toBe(308);
    expect(api.headers.get("location")).toBe("/api/v1/repos/lab/notes?x=1");
    const issue = await call(`/alice/notes/issues/${issueNumber}`, aliceRw);
    expect(issue.status).toBe(308);
    expect(issue.headers.get("location")).toBe(`/lab/notes/issues/${issueNumber}`);
    const pull = await call(`/api/v1/repos/alice/notes/pulls/${pullNumber}`, aliceRw);
    expect(pull.status).toBe(308);
    expect(pull.headers.get("location")).toBe(`/api/v1/repos/lab/notes/pulls/${pullNumber}`);
    // The new paths answer.
    expect((await call(`/api/v1/repos/lab/notes/pulls/${pullNumber}`, aliceRw)).status).toBe(200);
    expect((await call(`/api/v1/repos/lab/notes/issues/${issueNumber}`, aliceRw)).status).toBe(200);
  });
  test("a mutation under the old path is not applied: it answers 308", async () => {
    const res = await call("/api/v1/repos/alice/notes/issues", aliceRw, "POST", { title: "lost?" });
    expect(res.status).toBe(308);
    expect(res.headers.get("location")).toBe("/api/v1/repos/alice/notes/issues".replace("alice", "lab"));
    const count = app.db
      .query<{ n: number }, [string]>("SELECT COUNT(*) AS n FROM issue WHERE repo_id = ?1 AND title = 'lost?'")
      .get(repo.id);
    expect(count?.n).toBe(0);
  });
  test("the move leaves an audit row: who moved what from where to where", () => {
    expect(transfersOf(app.db, repo.id)).toEqual([
      expect.objectContaining({ from: "alice/notes", to: "lab/notes", actorId: alice.id }),
    ]);
  });
  test("a caller who cannot read the repository gets 404 from its old path, not where it went", async () => {
    const hidden = await createRepo(app, alice, { name: "hidden", visibility: "private" });
    if (!hidden.ok) throw new Error(String(hidden.error));
    expect((await call("/api/v1/repos/alice/hidden/transfer", aliceRw, "POST", { newOwner: "lab" })).status).toBe(200);
    expect((await call("/api/v1/repos/alice/hidden", aliceRw)).status).toBe(308);
    for (const path of ["/api/v1/repos/alice/hidden", "/alice/hidden"]) {
      const res = await call(path, bobRw);
      expect(res.status).toBe(404);
      expect(res.headers.get("location")).toBeNull();
    }
  });
  test("moved a second time, the first old path follows to the newest owner", async () => {
    const lab2 = createOrg(app, alice, "lab2");
    if (!lab2.ok) throw new Error(lab2.error);
    expect((await call("/api/v1/repos/lab/notes/transfer", aliceRw, "POST", { newOwner: "lab2" })).status).toBe(200);
    for (const old of ["alice", "lab"]) {
      const res = await call(`/${old}/notes/issues/${issueNumber}`, aliceRw);
      expect(res.status).toBe(308);
      expect(res.headers.get("location")).toBe(`/lab2/notes/issues/${issueNumber}`);
    }
    expect(transfersOf(app.db, repo.id).map((t) => t.to)).toEqual(["lab/notes", "lab2/notes"]);
  });
  test("a fork's borrowed objects follow its parent to the new place", async () => {
    const made = await makeRepo(app.db, app.reposRoot, { ownerId: alice.id, name: "parent", visibility: "public" });
    if (!made.ok) throw new Error(made.error);
    const c = await commitFiles(repoDir(app.reposRoot, "alice", "parent"), {
      branch: "main",
      message: "seed",
      files: [{ path: "a.txt", content: "a" }],
      author: { name: "T", email: "[email protected]" },
    });
    if (!c.ok) throw new Error("commit failed");
    const fork = await forkRepo(app.db, app.reposRoot, made.value, bob.id);
    if (!fork.ok) throw new Error(fork.error);
    const forkDir = repoDir(app.reposRoot, "bob", fork.value.name);
    const moved = await transferRepo(app.db, app.reposRoot, made.value, getUserByName(app.db, "lab")!, alice.id);
    expect(moved.ok).toBe(true);
    const alternates = readFileSync(join(forkDir, "objects", "info", "alternates"), "utf8");
    expect(alternates).toContain(join(repoDir(app.reposRoot, "lab", "parent"), "objects"));
    expect(alternates).not.toContain(repoDir(app.reposRoot, "alice", "parent"));
    const fsck = Bun.spawnSync(["git", "cat-file", "-e", `${c.value.commitOid}^{commit}`], { cwd: forkDir });
    expect(fsck.exitCode).toBe(0);
  });
  test("when the transaction fails the directory is renamed back and nothing changes", async () => {
    const made = await makeRepo(app.db, app.reposRoot, { ownerId: alice.id, name: "stays", visibility: "public" });
    if (!made.ok) throw new Error(made.error);
    app.db.exec(
      "CREATE TRIGGER refuse_transfer BEFORE INSERT ON repo_transfer BEGIN SELECT RAISE(ABORT, 'refused'); END",
    );
    try {
      const moved = await transferRepo(app.db, app.reposRoot, made.value, getUserByName(app.db, "lab")!, alice.id);
      expect(moved.ok ? "ok" : moved.error).toBe("move_failed");
    } finally {
      app.db.exec("DROP TRIGGER refuse_transfer");
    }
    expect(getRepoById(app.db, made.value.id)?.ownerName).toBe("alice");
    expect(existsSync(join(repoDir(app.reposRoot, "alice", "stays"), "HEAD"))).toBe(true);
    expect(existsSync(repoDir(app.reposRoot, "lab", "stays"))).toBe(false);
    expect(transfersOf(app.db, made.value.id)).toEqual([]);
    expect((await call("/api/v1/repos/lab/stays", aliceRw)).status).toBe(404);
  });
  test("two moves to the same owner and name at once: one lands, the other is refused", async () => {
    const twins: Repo[] = [];
    for (const owner of [alice, bob]) {
      const made = await makeRepo(app.db, app.reposRoot, { ownerId: owner.id, name: "twin", visibility: "public" });
      if (!made.ok) throw new Error(made.error);
      twins.push(made.value);
    }
    const lab = getUserByName(app.db, "lab")!;
    const results = await Promise.all(twins.map((t) => transferRepo(app.db, app.reposRoot, t, lab, alice.id)));
    expect(results.map((r) => (r.ok ? "ok" : r.error)).sort()).toEqual(["name_taken", "ok"]);
    const landed = results.findIndex((r) => r.ok);
    const other = twins[1 - landed]!;
    expect(getRepoById(app.db, other.id)?.ownerId).toBe(other.ownerId);
    expect(existsSync(join(repoDir(app.reposRoot, other.ownerName, "twin"), "HEAD"))).toBe(true);
    expect(getRepo(app.db, "lab", "twin")?.id).toBe(twins[landed]!.id);
  });
  test("a repository made again at the old path takes it back", async () => {
    const again = await createRepo(app, alice, { name: "notes", visibility: "public" });
    expect(again.ok).toBe(true);
    expect((await call("/api/v1/repos/alice/notes", aliceRw)).status).toBe(200);
  });
  test("the migration applies twice without complaint", () => {
    const sql = migrationFiles.find((m) => m.name.includes("repo-redirect"))!.sql;
    expect(() => app.db.exec(sql)).not.toThrow();
  });
});
@@ -0,0 +1,157 @@
/**
 * Moving a repository from the terminal's `:` palette (#569): an admin types
 * the new owner and the repository moves; a refusal says why in the API's
 * words; a writer who is not an admin, and an agent, are never offered it.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createRepo } from "../src/actions/repos.ts";
import { createApp, type App } from "../src/app.ts";
import { addTeamMember, createOrg, createTeam } from "../src/core/orgs.ts";
import { canAdmin, canWrite, getRepoById, type Repo } from "../src/core/repos.ts";
import { createUser, type User } from "../src/core/users.ts";
import type { Screen } from "../src/tui/app/app.ts";
import { style } from "../src/tui/term/style.ts";
import { createForgeApp } from "../src/tui/forge.ts";
import { transferRepoCommands } from "../src/tui/screens/transferrepo.ts";
import { getRepo } from "../src/core/repos.ts";
import { repoScreen } from "../src/tui/screens/repo.ts";
import { local } from "../src/tui/screens/where.ts";
import { headlessTerminal } from "../src/tui/term/terminal.ts";
import { quietLogs } from "./helpers/globals.ts";
import { settleApp } from "./helpers/tui.ts";
import { proveAll } from "./helpers/verified.ts";
quietLogs();
let dir: string;
let app: App;
let alice: User;
let bob: User;
let bot: User;
const KEYS: Record<string, string> = { enter: "\r" };
/** A screen that says it is beneath the repository's, so a test can see where the unwinding landed. */
const below: Screen = {
  title: "below",
  keys: [],
  render: (area, s) => void s.text(area.x, area.y, "BELOW-THE-REPO", style(0, 0), area.x + area.w),
  key: () => false,
};
function open(user: User, at: Repo, nested = false) {
  const terminal = headlessTerminal(120, 40);
  const { app: tui, session } = createForgeApp(
    app,
    { sshUsername: user.username, remoteAddress: "127.0.0.1", fingerprint: "SHA256:test", user },
    { terminal, exitHooks: false },
  );
  tui.start();
  if (nested) tui.ctx.push(below);
  tui.ctx.push(repoScreen(session, tui.ctx, local(session, at)));
  return {
    session,
    ctx: tui.ctx,
    text: () => tui.screen.toText(),
    feed: async (...keys: string[]) => {
      for (const k of keys) {
        terminal.feed(KEYS[k] ?? k);
        await settleApp(tui);
      }
    },
    stop: () => tui.stop?.(),
  };
}
/** Open the delete prompt from the palette once its row has drawn. */
async function prompt(h: ReturnType<typeof open>): Promise<void> {
  await h.feed(":", ..."Move this");
  for (let i = 0; i < 100 && !h.text().includes("old links answer"); i++)
    await new Promise<void>((r) => setTimeout(r, 10)), await h.feed();
  if (!h.text().includes("old links answer")) throw new Error(`never came: still waiting while !h.text().includes("old links answer")`);
  await h.feed("enter");
}
async function mkRepo(owner: string | undefined, name: string): Promise<Repo> {
  const made = await createRepo(app, alice, { ...(owner ? { owner } : {}), name, visibility: "public" });
  if (!made.ok) throw new Error(String(made.error));
  return made.value;
}
beforeAll(async () => {
  dir = await mkdtemp(join(tmpdir(), "forge-tui-transfer-repo-"));
  app = createApp({ dataDir: dir, port: 0 });
  const mk = async (username: string, first = false) => {
    const r = await createUser(app.db, {
      origin: "seed",
      trusted: true,
      username,
      email: `${username}@forge.local`,
      password: "a-good-passphrase",
      adminIfFirst: first,
    });
    if (!r.ok) throw new Error(r.error);
    return r.value;
  };
  alice = await mk("alice", true);
  bob = await mk("bob");
  bot = await mk("crewbot1");
  // An agent that is also a forge admin: canAdmin accepts it, so only the kind check keeps it out.
  app.db.query("UPDATE user SET is_agent = 1, is_admin = 1 WHERE id = ?1").run(bot.id);
  bot = { ...bot, kind: "agent", isAdmin: true };
  proveAll(app);
});
afterAll(async () => {
  app.db.close();
  await rm(dir, { recursive: true, force: true });
});
describe("move a repository in the terminal", () => {
  test("an admin who types an org's name moves the repository there", async () => {
    const org = createOrg(app.db, "lab", alice.id);
    if (!org.ok) throw new Error(org.error);
    const repo = await mkRepo(undefined, "wander");
    const h = open(alice, repo);
    await prompt(h);
    expect(h.text()).toContain("alice/wander");
    await h.feed(..."lab", "enter");
    expect(getRepoById(app.db, repo.id)?.ownerName).toBe("lab");
    expect(h.text()).toContain("moved alice/wander to lab/wander");
    h.stop();
  });
  test("a refusal is said in the API's words and the repository stays", async () => {
    await mkRepo("lab", "taken");
    const repo = await mkRepo(undefined, "taken");
    const h = open(alice, repo);
    await prompt(h);
    await h.feed(..."lab", "enter");
    expect(h.text()).toContain("already has a repository by that name");
    expect(getRepo(app.db, "alice", "taken")?.id).toBe(repo.id);
    h.stop();
  });
  test("a writer who is not an admin, and an agent, are not offered it", async () => {
    const org = createOrg(app.db, "acme", alice.id);
    if (!org.ok) throw new Error(org.error);
    const devs = createTeam(app.db, org.value.id, "devs", "write");
    if (!devs.ok) throw new Error(devs.error);
    addTeamMember(app.db, devs.value, bob.id);
    const shop = await mkRepo("acme", "shop");
    expect(canWrite(app.db, shop, bob)).toBe(true);
    expect(canAdmin(app.db, shop, bot)).toBe(true);
    for (const who of [bob, bot]) {
      const h = open(who, shop);
      expect(transferRepoCommands(h.session, h.ctx, shop)).toEqual([]);
      h.stop();
    }
    const h = open(alice, shop);
    expect(transferRepoCommands(h.session, h.ctx, shop).map((c) => c.title)).toEqual([
      "acme/shop — Move this repository to another owner",
    ]);
    h.stop();
  });
});
		@@ -15,3 +15,5 @@ A new read of a table that grows (`event`, `issue`, `run`, `comment`) names the
15	15	A new `/settings…` page route goes in `src/http/settings_routes.ts` (`settingsRoutes`), not `src/http/server.ts`.
16	16
17	17	State shared between modules through process memory, not the database, is named here. `src/perf/views_report.ts`: `readVisits` holds each scope and window's visits for 15 seconds (dropped by `flushViews`), so a page and its probe share one read; `src/perf/views_store.ts`: the view buffer, flushed every 10 seconds. The traffic sources view's terminal door is `src/tui/screens/trafficview.ts` (palette entry for admins, per-app command for a repository's admins). `src/runs/held.ts`: each dispatcher pass (`src/crew/dispatch.ts`, `pump`) records which queued agent runs it held and why (valve, pace, limit), and vitals (`src/kernel/vitals.ts`) leaves those out of `queue:agent`. A record older than `HELD_FRESH_MS` is ignored, so a stopped dispatcher cannot hide its queue.
	18
	19	`src/core/transfer.ts`: the old owner/name pairs a transfer left behind (`repo_redirect`), held per database after the first request reads them and dropped by `transferRepo`, so a request under a path nothing moved from costs no statement (#569).
		@@ -0,0 +1,31 @@
	1	# Moving a repository to another owner
	2
	3	From the terminal: on a repository's screen, `:` then "Move this repository
	4	to another owner", and type the new owner. From the API:
	5	`POST /api/v1/repos/:owner/:name/transfer` with `{"newOwner": "<account or org>"}`
	6	moves a repository (an `rw` token; the caller administers the repository and
	7	may create repositories under the new owner — themselves, or an org they can
	8	write to). It is refused when the new owner already has a repository by that
	9	name.
	10
	11	What moves: the repository row's owner and the bare repository on disk, in
	12	one step — the directory is renamed back if the database write fails.
	13	Everything keyed by the repository (its app, secrets, crew, autonomy,
	14	direction, issues and pulls) travels with it; a fork's link to its objects is
	15	rewritten. Nothing else on disk is named by owner/name: an app's data lives
	16	under its app id, crew checkouts and install caches under the repository's
	17	id, and mirrors under its id, so none of them move. Moves run one at a time,
	18	so two moves to the same owner/name cannot both pass the checks.
	19
	20	Who moved what from where to where is kept twice: an audit row in
	21	`repo_transfer`, written in the move's own transaction and never rewritten,
	22	and a `repo.transferred` event for the repository's readers.
	23
	24	Old paths keep working: a web or API request under the old `owner/name`
	25	answers `308` to the same path under the new owner, for reads and writes
	26	alike (a write is never applied silently; the client re-sends it). Someone
	27	who cannot read the repository still gets `404`. Making a new repository at
	28	the old path takes the path back.
	29
	30	Not yet: git remotes under the old path, runs and previews follow in the next
	31	step.
		@@ -0,0 +1,63 @@
	1	/**
	2	* Transfer a repository to another owner (#569). The caller administers the
	3	* repository and may create repositories under the new owner (themselves, or
	4	* an org they can write to — the same rule as making one there). An agent
	5	* never moves anything. The move is `core/transfer.ts`; the event
	6	* (`repo.transferred`, for the repository's readers) and the audit row
	7	* (`repo_transfer`, written in the move's own transaction) say who moved what
	8	* where.
	9	*/
	10
	11	import type { App } from "../app.ts";
	12	import { getUserByName, type User } from "../core/users.ts";
	13	import { canAdmin, type Repo } from "../core/repos.ts";
	14	import { transferRepo, type TransferError } from "../core/transfer.ts";
	15	import { storageChanged } from "../core/storage.ts";
	16	import { err, ok, type Result } from "../kernel/result.ts";
	17	import { resolveOwner } from "./repos.ts";
	18
	19	export type TransferActionError = TransferError \| "not_found" \| "forbidden_owner" \| "unknown_owner";
	20
	21	export const TRANSFER_SAID: Readonly<Record<Exclude<TransferActionError, "not_found">, string>> = {
	22	name_taken: "The new owner already has a repository by that name.",
	23	same_owner: "The repository already belongs to that owner.",
	24	move_failed: "The repository could not be moved; nothing changed.",
	25	forbidden_owner: "You cannot create repositories under that owner.",
	26	unknown_owner: "No account or organisation has that name.",
	27	};
	28
	29	/** The HTTP status each refusal answers with. */
	30	export const TRANSFER_STATUS: Readonly<Record<Exclude<TransferActionError, "not_found">, number>> = {
	31	name_taken: 409,
	32	same_owner: 409,
	33	move_failed: 500,
	34	forbidden_owner: 403,
	35	unknown_owner: 422,
	36	};
	37
	38	export async function transferRepository(
	39	app: App,
	40	actor: User \| undefined,
	41	repo: Repo,
	42	newOwner: string,
	43	): Promise<Result<Repo, TransferActionError>> {
	44	if (actor === undefined \|\| actor.kind === "agent" \|\| !canAdmin(app.db, repo, actor)) return err("not_found");
	45	const target = getUserByName(app.db, newOwner);
	46	if (target === undefined \|\| target.kind === "agent") return err("unknown_owner");
	47	const ownerId = resolveOwner(app, actor, target.username);
	48	if (ownerId !== target.id && !actor.isAdmin) return err("forbidden_owner");
	49	const moved = await transferRepo(app.db, app.reposRoot, repo, target, actor.id);
	50	if (!moved.ok) return moved;
	51	storageChanged(app, repo.ownerId);
	52	storageChanged(app, target.id);
	53	app.bus.append({
	54	kind: "repo.transferred",
	55	repoId: repo.id,
	56	actorId: actor.id,
	57	payload: {
	58	from: `${repo.ownerName}/${repo.name}`,
	59	to: `${moved.value.ownerName}/${moved.value.name}`,
	60	},
	61	});
	62	return ok(moved.value);
	63	}
		@@ -320,6 +320,7 @@ export { route as postApiV1ReposOwnerNameRunsIdCancel } from "./postApiV1ReposOw
320	320	export { route as postApiV1ReposOwnerNameRunsIdSteer } from "./postApiV1ReposOwnerNameRunsIdSteer.ts";
321	321	export { route as postApiV1ReposOwnerNameSpend } from "./postApiV1ReposOwnerNameSpend.ts";
322	322	export { route as postApiV1ReposOwnerNameSync } from "./postApiV1ReposOwnerNameSync.ts";
	323	export { route as postApiV1ReposOwnerNameTransfer } from "./postApiV1ReposOwnerNameTransfer.ts";
323	324	export { route as postApiV1ReposOwnerNameUpstreamCheck } from "./postApiV1ReposOwnerNameUpstreamCheck.ts";
324	325	export { route as postApiV1Sessions } from "./postApiV1Sessions.ts";
325	326	export { route as postApiV1Share } from "./postApiV1Share.ts";
		@@ -0,0 +1,18 @@
	1	import { REPO, type Route } from "../shared.ts";
	2
	3	export const route: Route = {
	4	method: "post",
	5	path: `${REPO}/transfer`,
	6	summary: "Move a repository to another owner, an account or an organisation the caller may create repositories under (rw scope, a repository admin's); its old web and API paths answer 308 to the new ones; answers the repository",
	7	auth: true,
	8	body: { newOwner: "string" },
	9	refusals: {
	10	not_found: "404: no such repository, or the caller is not its admin",
	11	bad_new_owner: "422: newOwner is not a name",
	12	unknown_owner: "422: no account or organisation has that name",
	13	forbidden_owner: "403: the caller cannot create repositories under that owner",
	14	name_taken: "409: the new owner already has a repository by that name",
	15	same_owner: "409: the repository already belongs to that owner",
	16	move_failed: "500: the repository could not be moved; nothing changed",
	17	},
	18	};
		@@ -144,6 +144,8 @@ const READER_KINDS: ReadonlySet<string> = new Set([
144	144	"repo.links_probed",
145	145	"repo.detached",
146	146	"repo.deleted",
	147	// Who moved a repository from where to where (#569): its readers knew both paths.
	148	"repo.transferred",
147	149	"label.updated",
148	150	"label.deleted",
149	151	"telemetry.granted",
		@@ -0,0 +1,1 @@
	1	8b91e4340037d69d32cb5f9001336fb4ce44f759f275d052df5ff1c9a2437a53
		@@ -0,0 +1,29 @@
	1	// Where a moved repository went (#569): one row per old owner/name, naming
	2	// the repository by id, so its old web and API paths answer 308 to wherever
	3	// it lives now — even after a second move. Written by `transferRepo`
	4	// (`core/transfer.ts`) in the same transaction as the repo row's new owner;
	5	// a repository later made at the old path takes it back (the row is only
	6	// read when no repository answers there). Cascades with the repository.
	7	// `repo_transfer` is the audit trail: one row per move, never rewritten —
	8	// who moved which repository from where to where, and when.
	9	// Idempotent (#558): a second apply finds the table and changes nothing.
	10	export default `
	11	CREATE TABLE IF NOT EXISTS repo_redirect (
	12	owner_name TEXT NOT NULL COLLATE NOCASE,
	13	name TEXT NOT NULL COLLATE NOCASE,
	14	repo_id TEXT NOT NULL REFERENCES repo(id) ON DELETE CASCADE,
	15	moved_by TEXT NOT NULL DEFAULT '',
	16	created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
	17	PRIMARY KEY (owner_name, name)
	18	);
	19	CREATE INDEX IF NOT EXISTS repo_redirect_repo ON repo_redirect(repo_id);
	20	CREATE TABLE IF NOT EXISTS repo_transfer (
	21	id TEXT PRIMARY KEY,
	22	repo_id TEXT NOT NULL,
	23	from_path TEXT NOT NULL,
	24	to_path TEXT NOT NULL,
	25	actor_id TEXT NOT NULL,
	26	created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
	27	);
	28	CREATE INDEX IF NOT EXISTS repo_transfer_repo ON repo_transfer(repo_id, id);
	29	`;
		@@ -0,0 +1,168 @@
	1	/**
	2	* Moving a repository to another owner (#569): the storage half. The bare
	3	* repository is renamed on disk, then one transaction gives the repo row its
	4	* new owner and records where the old path went (`repo_redirect`). When the
	5	* transaction fails the directory is renamed back, so disk and rows never
	6	* disagree. Everything else about a repository — its app, secrets, crew,
	7	* autonomy, direction, issues and pulls — is keyed by the repo's id, so it
	8	* travels with the row; an app's data lives under its app id and does not
	9	* move. A fork's `alternates` file names its parent's objects by absolute
	10	* path, so each fork's is rewritten to the new place.
	11	*/
	12
	13	import type { Database } from "bun:sqlite";
	14	import { mkdir, readFile, rename, rmdir, writeFile } from "node:fs/promises";
	15	import { dirname, join } from "node:path";
	16	import { closeReader } from "../git/read.ts";
	17	import { repoDir, repoDirExists } from "../git/repos.ts";
	18	import { id } from "../kernel/id.ts";
	19	import { err, ok, type Result } from "../kernel/result.ts";
	20	import { forgetListings } from "./listings.ts";
	21	import { getRepo, getRepoById, listForks, type Repo } from "./repos.ts";
	22	import type { User } from "./users.ts";
	23
	24	export type TransferError = "name_taken" \| "same_owner" \| "move_failed";
	25
	26	/**
	27	* The old owner/name pairs, held in process memory per database so the
	28	* common request — under a path nothing moved from — costs no statement.
	29	* Loaded on first use; `transferRepo` drops it. A pair whose row has gone
	30	* (its repository deleted) only costs the one lookup that finds nothing.
	31	*/
	32	const moved = new WeakMap<Database, Set<string>>();
	33	const key = (ownerName: string, name: string): string => `${ownerName.toLowerCase()}/${name.toLowerCase()}`;
	34
	35	function movedPaths(db: Database): Set<string> {
	36	let paths = moved.get(db);
	37	if (paths === undefined) {
	38	paths = new Set(
	39	db
	40	.query<{ owner_name: string; name: string }, []>("SELECT owner_name, name FROM repo_redirect")
	41	.all()
	42	.map((r) => key(r.owner_name, r.name)),
	43	);
	44	moved.set(db, paths);
	45	}
	46	return paths;
	47	}
	48
	49	/** Where an old owner/name went, when no repository answers there now. */
	50	export function redirectFor(db: Database, ownerName: string, name: string): Repo \| undefined {
	51	if (!movedPaths(db).has(key(ownerName, name))) return undefined;
	52	const row = db
	53	.query<{ repo_id: string }, [string, string]>(
	54	"SELECT repo_id FROM repo_redirect WHERE owner_name = ?1 AND name = ?2",
	55	)
	56	.get(ownerName, name);
	57	if (row === null) return undefined;
	58	if (getRepo(db, ownerName, name) !== undefined) return undefined;
	59	return getRepoById(db, row.repo_id);
	60	}
	61
	62	async function rewriteAlternates(forkDir: string, from: string, to: string): Promise<void> {
	63	const file = join(forkDir, "objects", "info", "alternates");
	64	const text = await readFile(file, "utf8").catch(() => undefined);
	65	if (text === undefined \|\| !text.includes(from)) return;
	66	await writeFile(file, text.split(from).join(to));
	67	}
	68
	69	/**
	70	* One transfer at a time in this process: the checks (name free, place
	71	* free), the rename and the transaction run as one step, so two moves to
	72	* the same owner/name cannot both pass the checks, and a rollback never
	73	* renames back over a directory another move just put there. Moves are rare;
	74	* a single queue costs nothing worth a finer lock.
	75	*/
	76	let queue: Promise<unknown> = Promise.resolve();
	77
	78	export function transferRepo(
	79	db: Database,
	80	reposRoot: string,
	81	repo: Repo,
	82	target: User,
	83	movedBy: string,
	84	): Promise<Result<Repo, TransferError>> {
	85	const turn = queue.then(() => moveNow(db, reposRoot, repo, target, movedBy));
	86	queue = turn.catch(() => undefined);
	87	return turn;
	88	}
	89
	90	async function moveNow(
	91	db: Database,
	92	reposRoot: string,
	93	stale: Repo,
	94	target: User,
	95	movedBy: string,
	96	): Promise<Result<Repo, TransferError>> {
	97	// The row as it is now, not as the caller read it before waiting its turn.
	98	const repo = getRepoById(db, stale.id);
	99	if (repo === undefined) return err("move_failed");
	100	if (target.id === repo.ownerId) return err("same_owner");
	101	if (getRepo(db, target.username, repo.name) !== undefined) return err("name_taken");
	102	const from = repoDir(reposRoot, repo.ownerName, repo.name);
	103	const to = repoDir(reposRoot, target.username, repo.name);
	104	if (await repoDirExists(to)) return err("name_taken");
	105	const hadDir = await repoDirExists(from);
	106	if (hadDir) {
	107	closeReader(from);
	108	await mkdir(dirname(to), { recursive: true });
	109	try {
	110	await rename(from, to);
	111	} catch {
	112	return err("move_failed");
	113	}
	114	}
	115	const fromPath = `${repo.ownerName}/${repo.name}`;
	116	const toPath = `${target.username}/${repo.name}`;
	117	try {
	118	db.transaction(() => {
	119	db.query("UPDATE repo SET owner_id = ?1 WHERE id = ?2").run(target.id, repo.id);
	120	// The new path is a real repository now; a redirect that pointed it
	121	// elsewhere would never be read, so it goes.
	122	db.query("DELETE FROM repo_redirect WHERE owner_name = ?1 AND name = ?2").run(target.username, repo.name);
	123	db.query(
	124	`INSERT INTO repo_redirect (owner_name, name, repo_id, moved_by) VALUES (?1, ?2, ?3, ?4)
	125	ON CONFLICT (owner_name, name) DO UPDATE SET repo_id = excluded.repo_id,
	126	moved_by = excluded.moved_by, created_at = excluded.created_at`,
	127	).run(repo.ownerName, repo.name, repo.id, movedBy);
	128	db.query(
	129	"INSERT INTO repo_transfer (id, repo_id, from_path, to_path, actor_id) VALUES (?1, ?2, ?3, ?4, ?5)",
	130	).run(id(), repo.id, fromPath, toPath, movedBy);
	131	})();
	132	moved.delete(db);
	133	} catch {
	134	if (hadDir) await rename(to, from).catch(() => undefined);
	135	return err("move_failed");
	136	}
	137	if (hadDir) {
	138	// The old owner's directory may be empty now; leave it if not.
	139	await rmdir(dirname(from)).catch(() => undefined);
	140	const objectsFrom = join(from, "objects");
	141	const objectsTo = join(to, "objects");
	142	for (const fork of listForks(db, repo.id)) {
	143	await rewriteAlternates(repoDir(reposRoot, fork.ownerName, fork.name), objectsFrom, objectsTo).catch(
	144	() => undefined,
	145	);
	146	}
	147	}
	148	forgetListings(db);
	149	const after = getRepoById(db, repo.id);
	150	return after === undefined ? err("move_failed") : ok(after);
	151	}
	152
	153	export interface TransferRecord {
	154	readonly from: string;
	155	readonly to: string;
	156	readonly actorId: string;
	157	readonly at: string;
	158	}
	159
	160	/** The audit trail of a repository's moves, oldest first. */
	161	export function transfersOf(db: Database, repoId: string): TransferRecord[] {
	162	return db
	163	.query<{ from_path: string; to_path: string; actor_id: string; created_at: string }, [string]>(
	164	"SELECT from_path, to_path, actor_id, created_at FROM repo_transfer WHERE repo_id = ?1 ORDER BY id",
	165	)
	166	.all(repoId)
	167	.map((r) => ({ from: r.from_path, to: r.to_path, actorId: r.actor_id, at: r.created_at }));
	168	}
		@@ -117,6 +117,7 @@ import {
117	117	resolveOwner,
118	118	updateRepoSettings,
119	119	} from "../actions/repos.ts";
	120	import { TRANSFER_SAID, TRANSFER_STATUS, transferRepository } from "../actions/transfer.ts";
120	121	import {
121	122	createToken,
122	123	HUMAN_CHECK_MESSAGE,
		@@ -1672,6 +1673,24 @@ export function apiRoutes(router: Router<Handler>): void {
1672	1673	return json({}, 200);
1673	1674	});
1674	1675
	1676	// Move a repository to another owner (#569): its old paths answer 308.
	1677	router.add("POST", "/api/v1/repos/:owner/:name/transfer", async (ctx) => {
	1678	const denied = requireScope(ctx, "rw");
	1679	if (denied) return denied;
	1680	const repo = loadRepo(ctx);
	1681	if (!repo) return notFound();
	1682	const input = await body(ctx.request);
	1683	const newOwner = input.newOwner;
	1684	if (typeof newOwner !== "string" \|\| newOwner.length === 0 \|\| newOwner.length > 64)
	1685	return apiError("bad_new_owner", 422, "newOwner is an account or organisation name");
	1686	const moved = await transferRepository(ctx.app, ctx.auth.user, repo, newOwner);
	1687	if (!moved.ok) {
	1688	if (moved.error === "not_found") return notFound();
	1689	return apiError(moved.error, TRANSFER_STATUS[moved.error], TRANSFER_SAID[moved.error]);
	1690	}
	1691	return json(repoJson(ctx, moved.value));
	1692	});
	1693
1675	1694	router.add("GET", "/api/v1/repos/:owner/:name/events", (ctx) => {
1676	1695	notePhase(ctx.request, "session", takeSessionTime(ctx.request));
1677	1696	const repo = loadRepo(ctx);